Docs / Build roadmap
Build Roadmap
This is the product-level done/limited/next map. Exact task evidence and resume instructions live in an internal engineering document; that document wins if this summary becomes stale.
Legend: Built = present in source · Limited = usable source exists but a release-critical condition remains · Next = ordered active work · Later = valuable but not ahead of the release-critical chain.
The current architecture is a Go control plane backed by a durable store interface (embedded bbolt for local/self-hosted deployments, Postgres for the live production deployment — see Platform architecture), a managed gb-noded render service, and the /api/sessions route family. Older phase plans and route names have been removed from this living roadmap.
Capability map
| Area | State | Evidence and boundary |
|---|---|---|
| Browser/CDP engine | Built | Isolated CDP sessions, warm pool, DOM-backed actions, accessibility refs, navigation, tabs, waits, and mobile/uinput primitives live under internal/. |
| MCP server | Built | cmd/gb-mcp registers 57 tools (pinned by cmd/gb-mcp/mcp_test.go), including PDF/cookies, Set-of-Mark, coordinate grounding, recording, and tabs. The binary itself cross-compiles clean for windows/amd64 (real Job Objects process-tree supervision, internal/browser/procgroup_windows.go) in addition to macOS/Linux; see Clients. |
| Credential safety | Built, release-limited | Origin allowlists, TOTP injection, audit, hard refusal of raw-JS/pixel oracles while armed, human approval broker, and gb-kmsd exist. The live proof does not cover the full KMS approval/injection/open chain. |
| Recording and streams | Limited | WAL, projections, video, optional DOM/screenshots, NDJSON/SSE/WebSocket, artifact indexes, and FS/R2 stores exist. Durable node spool/quotas and R2 reconciliation are still active work. |
| Control plane | Built | Accounts, workspaces, scoped keys, vault approvals, usage, artifacts, teams, webhooks, jobs, billing routes, session routing, REST v1, and the web console are implemented in cmd/gb-server. |
| Hosted structured sessions | Limited | Create/act/stream/share/close and node scheduling exist with public-only egress. Output budgets and durable lifecycle checkpoints remain open. |
| Hosted raw CDP | Built | POST /api/sessions with cdp:true returns a ticketed cdp_url; a scoped API key may instead use an Authorization: Bearer header. The node filters/rewrites selected commands to preserve egress policy. |
| Managed node | Built, hardening active | gb-noded registers, heartbeats, runs dedicated browser cells, records, reaps, and advertises bounded capacity. Recording ownership and large structured outputs still need the ordered controls below. |
| Webhooks and scheduled jobs | Limited | Signed delivery, SSRF defense, retry/scheduling controls, and REST v1 exist. Durable outbox/lifecycle/job-occurrence state awaits a schema decision. |
| Billing | Limited / disabled live | Plans, Stripe checkout/portal, and signed webhook handling exist. The observed deployment returned billing_enabled: false; the reviewed three-task chain must land before enablement. |
| Account lifecycle | Limited | Verification, reset, session controls, export, and local/indexed deletion exist. Complete R2, Stripe, node, and writer teardown is not finished. |
| Web console | Built; control plane observed live | The console exists in source, and the public control-plane health/plan endpoints responded on 2026-08-13. The current audit source itself was not deployed. |
| Desktop | Limited | Electron packages a console shell. One-click local-node install/control is later work; signing and publication remain artifact-specific gates. |
| iOS / Android | Limited | Client source exists. Store distribution and closed-app push require separate signing/provider gates. |
| SDK and integration assets | Built in source | Python SDK, Claude Code skill, Claude desktop extension, and GPT plugin/OpenAPI files exist; each distribution needs its own package/release proof. |
| Marketing/download site | Mixed deployment | Home and /download returned 200. macOS/Windows and legacy AppImage objects were reachable; the checked-in .deb-pending page had not yet been deployed. |
Ordered release-critical work
These items are dependency-ordered. Do not bypass an earlier item merely because a later worktree exists.
1. TASK-99 — reconcile R2 object and index state
Finish bounded, copy-only R2 inventory and crash recovery, including reserved-key rules, pagination, signing, typed service refusal, and account-erasure integration. The reconciler must never delete a source object as a repair shortcut.
Exit: normal R2 operations and startup reconciliation pass their red/green controls; crash-cut objects are inventoried; deletion can make a complete bounded decision instead of returning the current TASK-99 block.
2. TASK-68 — persist recording ownership and enforce quotas
Add the reviewed READY/ACK protocol to the managed node and bound WAL, video, archive, and aggregate recording bytes without evicting READY evidence.
Exit: a node restart cannot lose ownership of a completed-but-unacknowledged recording, and tenant input cannot grow recording storage without enforced limits.
3. TASK-100 — bound node-side structured outputs
Cap source and final JSON sizes for snapshot/read/extract/evaluate/mark and binary outputs, stream PDF with bounded reads, serialize heavy work, and return a typed client error on overflow. Raw CDP remains governed by its existing frame limit and policy path.
Exit: a tenant cannot force unbounded semantic-result copies in the shared node before the control plane's outer response limit.
4. TASK-94 — re-land the checkout-expiry release safely
TASK-88 billing-state serialization (13496fc) and TASK-98 event routing (1d225ae) are integrated. TASK-94 was integrated and reverted on 2026-08-14 (6739d8b): on this base, making a signed checkout.session.expired the only release blanks StripeSubID, which defeats the terminal-subscription tombstone and lets a redelivered update resurrect a canceled subscription; and a definitively-rejected Stripe create leaves the reservation unreleasable forever.
Re-landing it needs a durable record of the last terminal subscription id, so a reservation cannot destroy the tombstone, plus release-on-definitive-failure (keeping fail-closed only for genuinely ambiguous outcomes). Rerun delayed completion/expiry, duplicate-subscription, and mixed metadata/customer routing controls before enabling any paid plan.
Exit: TASK-94 is re-landed with those two properties and its race tests pass alongside TASK-88 and TASK-98; production configuration remains off until deployment and signed webhook probes pass.
5. TASK-89 — complete account teardown
After TASK-99 and the billing chain close, require authoritative subscription termination, workspace-tagged fleet drain/zero attestation, writer barriers, and closing-session CDP refusal before returning success.
Exit: deletion cannot leave a paid subscription, post-restart browser, R2 object, or writer capable of recreating customer data after the response.
6. Decide additive durable state
A user decision is required before changing the bbolt schema. The decision covers a webhook outbox, hosted-session lifecycle checkpoints, and leased scheduled-job occurrences.
Exit: either implement and migrate the approved additive buckets with restart tests, or explicitly narrow the product durability contract. Do not silently defer these gaps while describing the surfaces as durable.
7. Converge, release, deploy, and probe
Freeze the audit manifest, rerun the full multi-aspect review, repair surviving findings to zero, and record the acceptance evidence. Publish from a clean reviewed commit, deploy that exact commit, then probe the public URLs and critical workflows.
Exit: the handoff carries a CONVERGED marker, exact commit and deployment identity, green local/Cloud Build gates, and dated live evidence. An HTTP health response alone is not enough to establish product behavior.
Later product depth
These are intentionally behind the release-critical chain:
- warm-pool autoscaling and additional regions;
- selectable egress/geo products that preserve the hosted security boundary;
- one-click local-node lifecycle in the Electron client;
- signed mobile distribution and APNs/FCM delivery;
- deeper replay/performance analysis and additional recorder projections; and
- broader SDK examples and integration distribution.
Maintaining this roadmap
- Update the row and its release boundary in the same task that changes a product capability.
- Use exact current routes, counts, and authentication modes from source.
- Keep internal node endpoints, addresses, and deployment topology out of public product status.
- Move dated measurements to an evidence record; do not leave resolved phases or blockers in this living document.
- Deployment observations and the active dependency graph are tracked in internal engineering documents, not published here.